npm/@sveltejs/kit CVE-2025-67647: critical 9.1, EPSS 0.52%
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Action: Upgrade @sveltejs/kit to 2.49.5 or later.
npm i @sveltejs/kit@2.49.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.19.0 | 2.49.5 | - |
Fixed versions
| 2.49.5 |
Sources
- osv: GHSA-j62c-4x62-9r35
- nvd: CVE-2025-67647
- https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35
- https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fadapter-node%405.5.1
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.49.5
CVE-2025-67647 · published · modified · JSON